Salvatore Bonaccorso wrote:
>> - CVE-2026-113733: Fix a password hash disclosure to "view only" admin
>> users with custom user models. Admin users with the 'view' (but not
>> 'change') permission to a user model were shown the entire password
>> hash
>> when the model was not AUTH_USER_MODEL (or when AUTH_USER_MODEL
>> inherited
>> its password field from a concrete parent model through multi-table
>> inheritance).
>
> This should be only from 6.0 onwards, is this correct?
Yes, you are correct. I misparsed the issue due to the way it is phrasded —
prior
to Django 6.0, the admin does no obfuscation of the hash (which is not ideal,
but
a trivial issue). It is therefore not vulnerable in trixie either of course. (I
haven't checked the other CVEs yet.)
The changelog uploaded to sid is therefore misleading. I can fix that in a
future
upload, but shall I split this bug into two so you can track this more precisely
in the BTS, or is marking it as such in the security tracker enough?
Regards,
--
,''`.
: :' : Chris Lamb
`. `'` [email protected] 🍥 chris-lamb.co.uk
`-
